logwatch is a daily process for reporting and analyzing log files and I recently started getting errors on one of the CentOS Linux servers I manage and no daily report. The particular machine gets thousands of bounced emails per day and the mail log files get very large. logwatch had been reporting to me every single bounced email message so the report emails had got very large before stopping altogether. This post looks at the error messages I got and what I did to fix the problem.
As I mentioned, the daily emails got really big and then stopped coming altogether, seemingly at random. The particular server sends a lot of email marketing messages every couple of weeks and gets a large number of bounced emails when they are sent. The error message I got in the email from logwatch was as follows:
/etc/cron.daily/0logwatch: postdrop: warning: uid=0: Illegal seek sendmail: fatal: root(0): queue file write error
After a little research I discovered that the default maximum size of an individual email on the version of Postfix running this particular server is 10 MB. Because logwatch was reporting on all bounced emails the email report being sent was sometimes larger than then 10 MB maximum, so I got the above error message instead.
There were two solutions to my problem: either switch off reporting of the mail service, or increase the size limit of the maximum email message.
To increase the maximum size of an email message in postifx, add or edit the "message_size_limit = XYZ" setting to the /etc/postfix/main.cf configuration file and then reload postfix.
I’ve never been particularly interested in getting large logwatch emails containing information about all the emails that bounced, so decided to switch off reporting about the mail services instead. Refer to my post from yesterday titled "Stop logwatch reporting on a particular service on CentOS" about how to do this.